Frank
4c7465d00d
FrankBook-Pro becomes the only *arr/qBittorrent deployment. Every fleet container (qB + five arrs) now shares gluetun's netns, so all egress — torrent, indexer APIs, metadata lookups — exits the WireGuard tunnel by construction (AllowedIPs=0.0.0.0/0); the arrs' own ports publish on the gluetun unit, none on the arr units themselves. - dankserver/compose.yaml: remove the six arr services (the Aug 20 compose copy — never healthy, superseded; config dirs trashed on the host) - dankclaw/Caddyfile + shared/homepage/services.json: arr vhosts and probes repoint 192.168.0.235 -> 192.168.0.112 (FrankBook-Pro) - frankbook-pro units: five arrs join gluetun netns (Wants/After/Network); gluetun publishes 9696/8989/7878/8686/8787 alongside 8080/6881 - tests/frankbook_quadlet.bats: new VPN egress seam — every arr+qB unit must share gluetun's netns and publish no port; gluetun must publish the whole fleet's ports - deploy-plan.py: gluetun changes carry the whole netns family (a gluetun recreation kills all six joiners); dankserver compose set loses the arrs - AGENTS.md: deployment is complete only when unit tests AND the Playwright E2E suite both pass
50 lines
2.0 KiB
INI
50 lines
2.0 KiB
INI
# Quadlet unit: Gluetun VPN tunnel in FrankBook-Pro's podman machine.
|
|
#
|
|
# Install path is INSIDE the machine VM:
|
|
# /home/core/.config/containers/systemd/gluetun.container
|
|
# (installed by the frankbook-pro handler in scripts/deploy-remote.sh —
|
|
# install_quadlet targets the Linux hosts' systemctl --user, not the VM).
|
|
#
|
|
# WireGuard tunnel to ProtonVPN. qBittorrent and all five *arrs share this
|
|
# container's network namespace (Network=gluetun.container) so every fleet
|
|
# container's egress — torrent traffic, indexer APIs, metadata lookups —
|
|
# exits ONLY through the tunnel (AllowedIPs=0.0.0.0/0). Every fleet port
|
|
# publishes HERE; a netns-sharer publishes no ports of its own (same
|
|
# invariant as the dankclaw searxng/gluetun pair). Credentials live in
|
|
# /home/core/Containers/gluetun/env inside the VM (mode 0600, never
|
|
# committed); the private key is Mac-tunnel-specific and MUST NOT be copied
|
|
# from dankclaw — one WireGuard peer key cannot serve two machines at once.
|
|
[Unit]
|
|
Description=Gluetun VPN tunnel (FrankBook-Pro podman machine)
|
|
|
|
[Container]
|
|
ContainerName=gluetun
|
|
Image=docker.io/qmcgaw/gluetun:latest
|
|
AddCapability=NET_ADMIN
|
|
AddDevice=/dev/net/tun:/dev/net/tun
|
|
Environment=VPN_SERVICE_PROVIDER=${VPN_SERVICE_PROVIDER}
|
|
Environment=VPN_TYPE=${VPN_TYPE}
|
|
Environment=WIREGUARD_PRIVATE_KEY=${WIREGUARD_PRIVATE_KEY}
|
|
Environment=WIREGUARD_ADDRESSES=${WIREGUARD_ADDRESSES}
|
|
Environment=WIREGUARD_PUBLIC_KEY=${WIREGUARD_PUBLIC_KEY}
|
|
Environment=WIREGUARD_ENDPOINT_IP=${WIREGUARD_ENDPOINT_IP}
|
|
Environment=WIREGUARD_ENDPOINT_PORT=${WIREGUARD_ENDPOINT_PORT}
|
|
Environment=WIREGUARD_ALLOWED_IPS=${WIREGUARD_ALLOWED_IPS}
|
|
Environment=WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL=${WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL}
|
|
PublishPort=8080:8080
|
|
PublishPort=6881:6881
|
|
PublishPort=6881:6881/udp
|
|
PublishPort=9696:9696
|
|
PublishPort=8989:8989
|
|
PublishPort=7878:7878
|
|
PublishPort=8686:8686
|
|
PublishPort=8787:8787
|
|
|
|
[Service]
|
|
EnvironmentFile=/home/core/Containers/gluetun/env
|
|
TimeoutStartSec=900
|
|
Restart=always
|
|
|
|
[Install]
|
|
WantedBy=default.target
|